The Wave

1. 3h agoBleepingComputerFBI warns ARTEX AI hacking tool is powering global cyberattacksThe FBI issued a flash alert warning that the open-source Artex AI hacking framework is being used by cybercriminals and nation-state actors to automate intrusions at machine speed, with Amazon publishing a corroborating study the same day.

   2 articles

   1. 2d agoThe RecordEarliestFBI flash alert says Artex tool automating cyberattacks at ‘machine speed’
   2. 3h agoBleepingComputerPickupFBI warns ARTEX AI hacking tool is powering global cyberattacks

   CyberAIFBI warns hackers are using open-source AI framework ARTEX to automate attacks37 linked
2. 5h agoWiz Research · research by NordStellarLiteLLM Compromised, Steals Credentials | Wiz BlogWiz Research maps the cloud, code and AI secrets that infostealer malware harvests from developer endpoints and details how attackers turn them into cloud access, using NordStellar telemetry to rank stealer families and secret types.

   2 articles

   1. 5h agoWiz ResearchLiteLLM Compromised, Steals Credentials | Wiz Blog
   2. 5h agoWiz ResearchEarliestThe Infostealer Incursion: Cloud, Code & AI Breaches | Wiz Blog

   Cyber27 linked
3. 5h agoWiz ResearchThe Rise of Agentic Attacks: What They Look Like, and Where They're Headed | Wiz BlogWiz Research reviews public and private cases to outline recurring fingerprints of AI-agent-driven intrusions, including ARTEX, Hermes and custom agentic workflows.1 outletCyberFBI warns hackers are using open-source AI framework ARTEX to automate attacks18 linked
4. 5h agoWiz ResearchARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors | Wiz BlogWiz Research reports an actor using ARTEX, an open-source agentic AI penetration-testing framework, to run automated reconnaissance and identity-provider attacks against IT and software vendors throughout October 2026, linked to Microsoft's Storm-0940 supply-chain activity.1 outletCyberFBI warns hackers are using open-source AI framework ARTEX to automate attacks21 linked
5. 5h agoWiz ResearchIntroducing Atlas: Wiz's AI vulnerability researcher | Wiz BlogWiz outlines its AI agent intent-detection pipeline, which uses model I/O telemetry, layered LLM analysis, and runtime correlation, validated against a simulated benchmark and referencing the OpenAI–Hugging Face incident.

   2 articles

   1. 5h agoWiz ResearchIntroducing Atlas: Wiz's AI vulnerability researcher | Wiz Blog
   2. 5h agoWiz ResearchEarliestBuilding an AI Detection Engine for Agent Intent | Wiz Blog

   Cyber22 linked
6. 5h agoWiz ResearchHow to Evaluate AI Agent Cybersecurity Capabilities | Wiz BlogWiz Research published a blog post explaining its principles for benchmarking AI agent cybersecurity capabilities, drawing on its Cyber Model Arena v3.9 results across 59 agents and 327 challenges.1 outletCyber4 linked
7. 5h agoWiz Research · research by MandiantTrusted by Default: Qubole Cross-Account Access Abused in the Wild | Wiz BlogWiz reports a threat actor abused Qubole-linked AWS cross-account IAM roles in October 2026 to enumerate victim environments, harvest secrets, and exfiltrate S3 data.1 outletCyber1 linked
8. 4d agoWiz Research · research by WizSecret-based cloud supply-chain attacks: Case study and lessons for security teams | Wiz BlogWiz's free Scan for Good initiative, built with Google DeepMind and CISA, has surfaced more than 475 high and critical exposures across public sector, healthcare and open-source environments.

   15 articles · 2 outlets · TechTarget

   1. 5d agoWiz ResearchPickupTowards a better cloud vulnerability response model | Wiz Blog
   2. 4d agoTechTargetPickupScan for Good: Free AI security tool finds nearly 500 critical flaws
   3. 4d agoWiz ResearchSecret-based cloud supply-chain attacks: Case study and lessons for security teams | Wiz Blog
   4. 2d agoWiz ResearchPickupClaude Mythos and Cybersecurity: What Actually Changes? | Wiz
   5. 2d agoWiz ResearchPickupSoftware Supply Chain Security: Key Risks and Best Defenses | Wiz
   6. 5h agoWiz Research“Black October” for AI Developer Platforms | Wiz Blog
   7. 5h agoWiz ResearchPHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
   8. 5h agoWiz ResearchGitHub Actions Security Pt 1: Attacks & Defenses | Wiz Blog
   9. 5h agoWiz ResearchGheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles | Wiz Blog
   10. 5h agoWiz ResearchScan for Good: Finding Critical Exposures with AI | Wiz Blog
   11. 5h agoWiz ResearchHow Wiz's Blue Agent Traced a Multi-Cloud Attack | Wiz Blog
   12. 5h agoWiz ResearchScan for Good: AIを活用した重大な露出の特定 | Wiz ブログ
   13. 5h agoWiz ResearchArtifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 | Wiz Blog
   14. 5h agoWiz ResearchBreaking LiteLLM: From Auth Bypass to Cloud Compromise | Wiz Blog
   15. 5h agoWiz ResearchPickupA U.S. Navy Cloud Broker enhances cloud security with Wiz | Wiz

   Cyber169 linked
9. YesterdayBleepingComputer · research by CursorCursor confirms security breach led to malicious Claude Code extensionCursor disclosed that a breach traced to stolen Fireworks AI credentials let attackers push trojanized Claude Code extension versions to its marketplace, exposing up to 5,000 developers to attempted SSH backdoors.1 outletCyberFireworks AI breach exposes customer data at Uber, Notion and Cursor20 linked
10. YesterdayCSO Online · research by AikidoThousands of GitHub repos hit with secret-stealing malwareThreat actor behind the 'wfx-loot' campaign used about 4,800 compromised GitHub accounts to inject credential-stealing workflows into tens of thousands of repositories and stole CI and cloud secrets from at least 1,835 targets.

    2 articles · BleepingComputer

    1. 2d agoBleepingComputerEarliestHackers compromise 4,800 GitHub accounts to steal cloud credentials
    2. YesterdayCSO OnlinePickupThousands of GitHub repos hit with secret-stealing malware

    Cyber12 linked
11. 3d agoCyberScoop · research by HuntressRogue remote-access campaign spread through ScreenConnect add-on, researchers sayHuntress reports an intruder abused a third-party RMM+ extension in cloud-hosted ScreenConnect partner panels to push attacker-controlled ScreenConnect clients to at least 288 computers across 48 organizations, prompting ConnectWise to disable five extensions.

    4 articles · The Register

    1. 3d agoSecurityWeekPickupHackers Deploy Malware in Fresh ScreenConnect Campaign
    2. 3d agoThe RegisterPickupHackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
    3. 3d agoCybersecurity DivePickupConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect users
    4. 3d agoCyberScoopEarliestRogue remote-access campaign spread through ScreenConnect add-on, researchers say

    Cyber32 linked
12. 2d agoWIREDMicrosoft 365 Crawls Back to Life After a 24-Hour OutageMicrosoft 365 outage disrupted Outlook, Teams and Copilot worldwide for a second day, with Microsoft attributing it to cascading server health-check failures across data centers and no sign of a cyberattack.

    4 articles · 2 outlets

    1. 2d agoYahooPickupMicrosoft says it "restored service" after major worldwide outage
    2. 2d agoWIREDEarliestThe Microsoft Outage Is a Warning for the World
    3. 2d agoWIREDPickupMicrosoft 365 Crawls Back to Life After a 24-Hour Outage
    4. 2d agoYahooPickupMicrosoft says services fully restored after day-long global outage

    Microsoft 365 outage lasts about 24 hours, renewing dependence concerns89 linked
13. YesterdayAnthropicU.S. elections readinessAnthropic activated its AI Safety Level 3 deployment and security protections for Claude Opus 4 as a precautionary measure under its Responsible Scaling Policy.

    7 articles

    1. YesterdayAnthropicEarliestActivating AI Safety Level 3 protections
    2. YesterdayAnthropicPickupU.S. elections readiness
    3. YesterdayAnthropicChallenges in red teaming AI systems
    4. YesterdayAnthropicAnthropic update on independent evaluators
    5. YesterdayAnthropicPickupAnthropic is endorsing SB 53
    6. YesterdayAnthropicClaude does cyber competitions
    7. YesterdayAnthropicMeasurements for understanding the pace of AI development inside frontier labs

    AI176 linked
14. CT2d agoCisco TalosARTEX and beyond: AI-enabled penetration testing platformsCisco Talos documents growing in-the-wild misuse of AI-enabled penetration testing frameworks, focusing on the ARTEX platform used by criminal and China-nexus actors to automate reconnaissance and intrusion, and lists associated tooling and detection coverage.1 outletCyberAI16 linked
15. 4d agoCyberScoop · research by MicrosoftMicrosoft fixes over 1,000 vulnerabilities in November Patch TuesdayMicrosoft's November 2026 Patch Tuesday release fixes 1,094 flaws, including an exploited Outlook spoofing zero-day (CVE-2026-124194) that can leak NTLMv2 hashes.

    6 articles · Daily Mail

    1. 5d agoSecurityWeekEarliestExploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
    2. 5d agoThe RecordPickupMicrosoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row
    3. 4d agoCyberScoopPickupMicrosoft fixes over 1,000 vulnerabilities in November Patch Tuesday
    4. 4d agoDark ReadingPickupNovember Patch Tuesday: An Overflowing Cornucopia of CVEs
    5. 4d agoCSO OnlinePickupNovember 2026 Patch Tuesday: 63 Critical Microsoft fixes, plus an Outlook zero day that allows theft of hashed credentials
    6. 3d agoDaily MailPickupOutlook users warned about dangerous flaw that lets hackers hijack email accounts: Act now

    Cyber122 linked
16. 2d agoThe RegisterMicrosoft outage gives customers a crash course in dependence on RedmondA prolonged Microsoft 365 outage in November 2026 knocked out Exchange Online, Teams and Copilot, prompting critics to renew warnings about dependence on a single vendor.1 outletMicrosoft 365 outage lasts about 24 hours, renewing dependence concerns15 linked
17. 3d agoTechTargetMicrosoft CISO urges Artex regulation, but experts say it won’t workMicrosoft's global CISO Igor Tsyganskiy urged policymakers to regulate release and use of Artex, an open-source LLM-driven pen testing framework, while security experts argue regulation would hamper defenders without curbing criminal use.1 outletCyberAI21 linked
18. 3d agoPalo Alto Unit 42 · research by Unit 42ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to KnowUnit 42 reports that attackers are using the AI-powered red-teaming framework ARTEX, alongside CyberStrikeAI, to run autonomous intrusions that reach cloud environments through exposed APIs and password reset flows without exploiting software vulnerabilities.1 outletCyberAIFBI warns hackers are using open-source AI framework ARTEX to automate attacks11 linked
19. 4d agoComputerworldThe bad news for Microsoft in the Blue TsunamiComputerworld columnist argues that Democratic midterm wins will bring investigations, data center crackdowns, AI regulation and ICE budget cuts that threaten Microsoft's business.1 outletAI3 linked
20. 5d agoWiz ResearchWiz Research discovers "ExtraReplica"— a cross-account database vulnerability in Azure PostgreSQL | Wiz BlogWiz Research reports that 82% of organizations grant third-party cloud vendors wide read access and 76% grant roles enabling full account takeover, based on an analysis of 1,300+ AWS accounts and 40+ vendors.

    10 articles

    1. 5d agoWiz ResearchWiz Research discovers "ExtraReplica"— a cross-account database vulnerability in Azure PostgreSQL | Wiz Blog
    2. 5d agoWiz ResearchChaosDB: How to discover your vulnerable Azure Cosmos DBs and protect them | Wiz Blog
    3. 5d agoWiz ResearchThe cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors | Wiz Blog
    4. 5d agoWiz ResearchHow we broke the cloud with two lines of code: the full story of ChaosDB | Wiz Blog
    5. 5d agoWiz ResearchBingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover | Wiz Blog
    6. 5d agoWiz ResearchBingBang: How a simple developer mistake could have led to Bing.com takeover | Wiz Blog
    7. 5d agoWiz ResearchAttachMe: critical OCI vulnerability allows unauthorized access to customer cloud storage volumes | Wiz Blog
    8. 5d agoWiz ResearchChaosDB: How we hacked thousands of Azure customers’ databases | Wiz Blog
    9. 5d agoWiz Research“Secret” Agent Exposes Azure Customers To Unauthorized Code Execution | Wiz Blog
    10. 4d agoWiz ResearchPickupBreaking Down PHP2Shell with Sagi Tzadik & Thai Duong | Wiz

    Cyber161 linked
21. 5d agoWiz ResearchCompromised Microsoft Key: More Impactful Than We Thought | Wiz BlogWiz Research finds the compromised Microsoft MSA signing key could forge tokens for far more Azure AD applications than Microsoft disclosed, and that forged tokens are hard for customers to detect.1 outletCyber33 linked
22. 5d agoWiz ResearchStorm-0558 Update: Takeaways from Microsoft's recent report | Wiz BlogWiz Research analyzes Microsoft's September 2023 follow-up report on the Storm-0558 breach, drawing out takeaways on how the MSA signing key was likely stolen and what remains unanswered.1 outletCyber27 linked
23. 4d agoWiz Research · research by WizHacking GitHub with a Semicolon & Claude with Sagi Tzadik | WizWiz podcast episode in which researcher Sagi Tzadik explains how a semicolon in GitHub's git push option handling enabled a critical RCE, found using Claude paired with reverse engineering tooling.1 outletCyber13 linked
24. 5d agoWiz ResearchNew attack vectors emerge via recent EKS updates | Wiz BlogWiz Research details how attackers could abuse new AWS EKS Access Entries, Access Policies and Pod Identity features to enumerate clusters, escalate privileges and steal cloud credentials.1 outletCyber3 linked
25. 5d agoWiz ResearchMidnight Blizzard breach: analysis and best practices | Wiz BlogWiz Research breaks down how Midnight Blizzard used a compromised legacy test OAuth application to gain mailbox access in Microsoft's corporate tenant and lists detections and hardening steps against similar attacks.1 outletCyber6 linked
26. 5d agoWiz ResearchHunting for signs of persistence in the cloud: an IR guide following the CircleCI incident | Wiz BlogWiz Research published a cloud incident response guide that lists AWS, Azure and GCP APIs attackers could use to maintain persistence after the CircleCI breach and supplies hunting queries for each provider.1 outletCyber4 linked
27. 4d agoWiz Research · research by WizOperation Stormbreaker case study | WizWiz published a vendor case study describing how the Marine Corps Community Services (MCCS) used Wiz in its Operation StormBreaker initiative to cut Authorization to Operate timelines from about 18 months to 30 days.1 outletCyber7 linked
28. 5d agoDark ReadingAI Coding Agents Leak Thousands of Secrets to GitHubDark Reading reports that a Claude Code command can inadvertently commit credentials and other sensitive files to public GitHub repositories, exposing organizations to security gaps.1 outletCyber7 linked
29. 5d agoCSO Online · research by WizQubole supply chain attack exposed AWS, Entra ID, and Okta credentialsAn attacker used Qubole's compromised AWS IAM credentials to assume customer cross-account roles, exfiltrating data and harvesting AWS, Entra ID and Okta secrets across dozens of organizations in October 2026.1 outletCyberFireworks AI breach exposes customer data at Uber, Notion and Cursor8 linked
30. 6d agoCybersecurity DiveFinancially motivated threat cluster uses AI-enabled tools against banking sectorMicrosoft Threat Intelligence reports a Cambodia-based financially motivated group, Storm 3358, is using the AI-enabled Artex pen-testing framework against banking and financial firms worldwide, part of a broader wave of Artex-driven attacks.1 outletCyber11 linked
31. 9d agoCybersecurity DiveHackers enlist Artex to scan GitHub repositories for exposed secretsMicrosoft Threat Intelligence reports that hackers are using agentic AI tools such as Artex to hunt exposed GitHub secrets and abuse stolen credentials against downstream Azure and Microsoft 365 tenants.1 outletCyber12 linked
32. 9d agoCensysARTEX: Agentic AsbestosCensys finds ARTEX, a GitHub-published agentic AI attack tool, running on roughly 1,465 hosts, with exposed operator directories revealing malicious tooling tied to recent intrusions.1 outletCyberFBI warns hackers are using open-source AI framework ARTEX to automate attacks13 linked
33. 9d agoAxiosHow AI is enabling faster, more dangerous cyber warfareAxios reports that AI and automation are accelerating state-backed cyberattacks, citing CrowdStrike's findings on the China-linked Vapor Panda campaign using the Artex tool and the suspected Russia-linked refrigeration sabotage across European grocery stores.1 outletCyberAI31 linked
34. 11d agoCybersecurity DiveAttacker abuses Microsoft Entra ID to target downstream MSP clientsA lone hacker is abusing stolen Microsoft Entra ID application secrets to breach Microsoft 365 and Azure tenants at MSPs and their downstream clients, according to Todyl's report.1 outletCyber6 linked

Nothing in Hill activity is connected to this.

Nothing from this branch in view.

Times ET

1. RFIPAE RAS6d agoNavy PAE RAS seeks industry input on Angler mine neutralization ROV systems and support, solicitation N3485C-27-R-0001.Closes in 9 daysRoboticsDefenseLifecycle3 linked